-----BEGIN PGP SIGNED MESSAGE-----
- - - - -----BEGIN PRIVACY-ENHANCED MESSAGE-----
Proc-Type: 4,MIC-CLEAR
Content-Domain: RFC822
Originator-Certificate: MIICozCCAgwCAREwDQYJKoZIhvcNAQECBQAwgYYxC
zAJBgNVBAYTAlVTMSswKQYDVQQKEyJEZWZlbnNlIEluZm9ybWF0aW9uIFN5c3Rlb
XMgQWdlbmN5MTAwLgYDVQQLEydDZW50ZXIgZm9yIEluZm9ybWF0aW9uIFN5c3Rlb
XMgU2VjdXJpdHkxGDAWBgNVBAsTD0NvdW50ZXJtZWFzdXJlczAeFw05MzEyMDkxO
DU5MTZaFw05NTEyMDkxODU5MTZaMIGxMQswCQYDVQQGEwJVUzErMCkGA1UEChMiR
GVmZW5zZSBJbmZvcm1hdGlvbiBTeXN0ZW1zIEFnZW5jeTEwMC4GA1UECxMnQ2Vud
GVyIGZvciBJbmZvcm1hdGlvbiBTeXN0ZW1zIFNlY3VyaXR5MRgwFgYDVQQLEw9Db
3VudGVybWVhc3VyZXMxEzARBgNVBAsTCk9wZXJhdGlvbnMxFDASBgNVBAMTC1Bld
GUgSGFtbWVzMIGaMAoGBFUIAQECAgQAA4GLADCBhwKBgQDFFJkcaDOuS+6Ai2vmT
bwY6JRbhdzPsl6X60hnXruOw2WvrAhc8BTFB+id75m3M55i+Th6MxWH20QHyQq5u
yVghOu/s37OxIrj7irNPjtUdPv8b2m4hNGEW53QH6GmXkxLmgLzOhookpoYPC+uw
2MzibDnleVI50d2m//XsWs7hwIBAzANBgkqhkiG9w0BAQIFAAOBgQDHH6CmBoyWU
zPlqVnEWYKIBsifqdTJzkKfnoST7NDRIakUP49FP86Cyy1+2AKpUCWaxjq+wGHCH
RCNFCCrOwdC9z8XwJal/c69ml6eLRhOoX77ANndpU9E5+eHxP+6Ute6lc63K7+Lz
5xOULjmgaMmKDkTXveVcQO6R2CTY37vcA==
Issuer-Certificate: MIICNTCCAZ4CASIwDQYJKoZIhvcNAQECBQAwRDELMAkGA
1UEBhMCVVMxCzAJBgNVBAgTAk1EMSgwJgYDVQQKEx9UcnVzdGVkIEluZm9ybWF0a
W9uIFN5c3RlbXMgUENBMB4XDTk0MDIyNTE0NDkxMloXDTk0MDMwNzE0NDkxMlowg
YYxCzAJBgNVBAYTAlVTMSswKQYDVQQKEyJEZWZlbnNlIEluZm9ybWF0aW9uIFN5c
3RlbXMgQWdlbmN5MTAwLgYDVQQLEydDZW50ZXIgZm9yIEluZm9ybWF0aW9uIFN5c
3RlbXMgU2VjdXJpdHkxGDAWBgNVBAsTD0NvdW50ZXJtZWFzdXJlczCBmjAKBgRVC
AEBAgIEAAOBiwAwgYcCgYEA19l6BN7iTGYEU61qJETIjBh3iAeHzoL8sZ5KwFRZD
S/a1KnYlD1zJHR/KeQCOBWW2HzX43TFLCNGU7UD9i6m8AymLe5IJf/bGh0Rne7Jd
Q1GAOLw7/J4hE57IMbGETZpzeU1D9IYxiERRNio/oa422lUlS9JZHLA5jaPNcUrX
P8CAQMwDQYJKoZIhvcNAQECBQADgYEApkliqAdudoOxvOFmQkOZbSgtlpn61VcNC
R7azDNJa2ulevaebptwSTs2OvMeuR/J0Ez4TC7XrJXLVjI5huRAqc+EWGRpZYRMa
CARZyE7gGYjUqS7DIQazfskeWiB8zheyW5tCVn+jnB09AZXtgbM6qRjyqrmSdCpg
CtfgazIKqI=
Issuer-Certificate: MIIB8jCCAVsCAQEwDQYJKoZIhvcNAQECBQAwRDELMAkGA
1UEBhMCVVMxCzAJBgNVBAgTAk1EMSgwJgYDVQQKEx9UcnVzdGVkIEluZm9ybWF0a
W9uIFN5c3RlbXMgUENBMB4XDTkzMDUyODE3MTEyN1oXDTk1MDUyODE3MTEyN1owR
DELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAk1EMSgwJgYDVQQKEx9UcnVzdGVkIEluZ
m9ybWF0aW9uIFN5c3RlbXMgUENBMIGaMAoGBFUIAQECAgQAA4GLADCBhwKBgQDbL
xaRlS3u54yyRgVDI5dcE9nlasL8fJqOGlyo7xH2FZnr3kUfsFj7OGiYsr6UbvqwK
nyfMIRUrXDUa64leGmft3SK27psDUHOynRSCc40d/HrDf810U5tnTamBKUIMqivK
4GoL0tMRA1eX6hALAvLLgK1HbnwZAo6GqQGW8CIJQIBAzANBgkqhkiG9w0BAQIFA
AOBgQDBp5aC6oV6IuFi8JCctq57bew604HHNllgjjp7zdXafq6jctRg2g91k/yFW
h19bJC/tNrb0WVwuZOs5L/FToPMNIIHzaW/YSROBmyhTDYaKHZGj0P1+iNjMbHt9
dm1QEHGIfKgBwFidItnOa74DfkXdijlPRnr/+E2Ib6PM+hEfQ==
MIC-Info: RSA-MD5,RSA,mxs4wXfM82AeASKqmzJZhR3kt+y8ujMvxP0/JYWEIGK
Dvi0eeNKWg2hz5AvehqTVjvA1wqHnF7JVnJKnD2x9GMmXkJb2tQQ6APZFsXF7cBw
7+Eg92B90VMGu5T5kietNTHzZo+zwU0an1uJMeuRQzTJRwLHimIq53lTKBXOGLx0
=
<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
Automated Systems Security Incident Support Team
_____
___ ___ _____ ___ _____ | /
/\ / \ / \ | / \ | | / Integritas
/ \ \___ \___ | \___ | | < et
/____\ \ \ | \ | | \ Celeritas
/ \ \___/ \___/ __|__ \___/ | |_____\
<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
Bulletin 95-10
Release date: 8 March, 1995, 6:30 PM EST (GMT -5)
SUBJECT: Vulnerability in Silicon Graphics (SGI) IRIX 5.2, 6.0, 6.0.1
Desktop Permissions Tool.
SUMMARY: A vulnerability exists within the Desktop Permissions Tool
of SGI IRIX 5.2, 6.0, and 6.0.1 operating systems. This problem has
been corrected in IRIX 5.3 and future releases.
BACKGROUND: The Desktop Permissions Tool should only allow users to
modify the permissions on files they own or have privileges to modify.
By exploiting a vulnerability in Desktop Permissions Tool, users
can modify the permissions for any file.
IMPACT: Users can gain unauthorized and/or privileged access to
system resources.
RECOMMENDED SOLUTION: The following fixes have been provided by SGI
Engineering.
A. Immediate Solution.
Either remove the setuid/setgid bits on /usr/lib/permissions, or
entirely remove the Desktop Permissions Tool. Removing the
setuid/setgid bits will limit the tool to only function on files
owned by the user using the tool.
1) Become the root user on the system.
% /bin/su -
Password:
#
2) Change the unix permissions level on the desktop
permissions program.
# chmod u-s /usr/lib/desktop/permissions
# chmod g-s /usr/lib/desktop/permissions
3) Return to previous user.
# exit
%
B. Long Term Solution.
IRIX 5.0.x, 5.1.x
- - - - - -----------------
The versions 5.0.x and 5.1.x of IRIX were limited hardware specific
releases and have since been made obsolete by later versions of IRIX
and are not subject to this vulnerability. For supportability reasons,
SGI recommends upgrading to at least IRIX 5.2 as a first step for all
problem resolution in these versions.
IRIX 5.2, 6.0, 6.0.1 (IRIX 5.3 IS NOT SUBJECT TO THIS VULNERABILITY)
- - - - - --------------------------------------------------------------------
For the IRIX operating system versions 5.2, 6.0 and 6.0.1, an inst-able
patch has been generated and can be obtained via anonymous ftp and/or
from your service/support provider. The patch is number 373 and will
install on IRIX 5.2, 6.0 and 6.0.1. NOTE: Inst-able patches require a
patch-aware inst program. The stock 5.2 inst program with the base
install is not patch-aware. The 6.0 and 6.0.1 inst programs are. A
patch-aware inst program for IRIX 5.2 is available as patch number 0, 34,
or 84. Any one of these may be used, but SGI recommends using 84 (the
latest) which is available from your service provider or the usual SGI
anonymous ftp sites.
The primary SGI anonymous ftp site is ftp.sgi.com (192.48.153.1).
Additionally, the alternative SGI anonymous ftp site, sgigate.sgi.com
(204.94.209.1) can be accessed for the same files. On each of these
servers, patch 373 can be found in the following directories:
~ftp/Security
or
~ftp/Patches/5.2
~ftp/Patches/6.0
~ftp/Patches/6.0.1
Checksums
- - - - - ---------
The actual patch will be a tar file containing the following files:
Filename: patchSG0000373
Algorithm #1 (sum -r): 51249 1 patchSG0000373
Algorithm #2 (sum): 21641 1 patchSG0000373
MD5 checksum: 40A604013A05C2521152ED4B51C5D9A5
Filename: patchSG0000373.desktop_eoe_sw
Algorithm #1 (sum -r): 09134 88 patchSG0000373.desktop_eoe_sw
Algorithm #2 (sum): 63013 88 patchSG0000373.desktop_eoe_sw
MD5 checksum: D74F9BDED3D51E9D28666CADF1B31945
Filename: patchSG0000373.idb
Algorithm #1 (sum -r): 50435 1 patchSG0000373.idb
Algorithm #2 (sum): 41363 1 patchSG0000373.idb
MD5 checksum: 790E9A47909BC32D8E9FCE14EA4077D8
For additional information about SGI security, patches or assistance,
please contact your SGI support provider. Questions can be sent via
e-mail to cse-security-alert@csd.sgi.com. To report new SGI security
vulnerability information, send e-mail to security-alert@sgi.com.
ASSIST would like to thank Silicon Graphics Customer Services
Engineering for information contained in this bulletin.
<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
ASSIST is an element of the Defense Information Systems Agency
(DISA), Center for Information Systems Security (CISS), that
provides service to the entire DoD community. Constituents
of the DoD with questions about ASSIST or computer security
security issues, can contact ASSIST using one of the methods
listed below. Non-DoD organizations/institutions, contact
the Forum of Incident Response and Security Teams (FIRST)
(FIRST) representative. To obtain a list of FIRST member
organizations and their constituencies send an email to
docserver@first.org with an empty "subject" line and a message body
containing the line "send first-contacts".
ASSIST Information Resources: To be included in the distribution
list for the ASSIST bulletins, send your Milnet (Internet) e-mail
address to assist-request@assist.mil. Back issues of ASSIST
bulletins, and other security related information, are available
from the ASSIST BBS at 703-756-7993/1154 DSN 289-7993/1154,
and through anonymous FTP from assist.mil (IP address
199.211.123.11). Note: assist.mil will only accept anonymous FTP
connections from Milnet addresses that are registered with the
NIC or DNS.
As of 1 April 1995, ASSIST will cease using Privacy Enhanced Mail
(PEM) as the primary digital signature mechanism for ASSIST
bulletins and begin using Pretty Good Privacy (PGP) 2.6.2. In the
interim from now until 1 April 1995, ASSIST will use both PEM and
PGP to sign e-mail bulletins. PGP 2.6.2 incorporates the
RSAREF(tm) Cryptographic Toolkit under license from RSA Data
Security, Inc. A copy of that license is available via anonymous
FTP from net-dist.mit.edu (IP 18.72.0.3) in the file
/pub/PGP/rsalicen.txt. In accordance with the terms of that
license, PGP 2.6.2 may be used for non-commercial purposes only.
Instructions for downloading the PGP 2.6.2 software can also be
obtained from net-dist.mit.edu in the pub/PGP/README file. PGP
2.6.2 and RSAREF may be subject to the export control laws of the
United States of America as implemented by the United States
Department of State Office of Defense Trade Controls. The PGP
signature information will be attached to the end of ASSIST
bulletins.
ASSIST Contact Information:
PHONE: 800-357-4231 (or 703-756-7974 DSN 289), duty hours are 06:00
to 22:30 EDT (GMT -4) Monday through Friday. During off duty hours,
weekends and holidays, ASSIST can be reached via pager at 800-791-
4857. The page will be answered within 30 minutes, however if a
quicker response is required, prefix the phone number with "999".
ELECTRONIC MAIL: Send to assist@assist.mil.
ASSIST BBS: Leave a message for the "sysop".
Reference herein to any specific commercial product, process, or
service by trade name, trademark manufacturer, or otherwise, does
not constitute or imply its endorsement, recommendation, or
favoring by ASSIST. The views and opinions of authors expressed
herein shall not be used for advertising or product endorsement
purposes.
- -----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.6
mQCNAi4uZ40AAAEEAM1uraimCNeh5PtzX7KoGxC2u8uMTdl8V5sujk3MHbWvCuOM
W0FqDy5s9iwfQLZWzJ7cbM6L0mNOj8eJGoz7TqGKZDDRFlKAwg0x8joleZLC2gXw
FVdF/g6Mdv7ok7heoa+Y//YMeADnsSrmzqLCnhFbKYffww3EbdH6sbnW3Io9AAUR
tB9BU1NJU1QgVGVhbSA8YXNzaXN0QGFzc2lzdC5taWw+iQCVAwUQL1xx7tH6sbnW
3Io9AQEBYwP9FvIJbnKjtMLUj8ghd6hophSx8WZnfQsOmZX/BbX8vKz1a5BkBn4q
ANvW+uKGdUlE8LLMEm1PD59Cihcb3OoWDOU8zIOIErvry4eqa+LzEXV8nnBdes+A
a1MCMGSz+K3OaP78lQ7JCGoY9TXTWIelfAdBVBG4VQcSQRn8tjRdG2e0KEFTU0lT
VCBUZWFtIDxhc3Npc3RAYXNzaXN0Lmltcy5kaXNhLm1pbD6JAJUCBRAuLnHoh0Y9
0jC+b6kBAU0TA/4yXSL7K6tcfVm9ACnP4crCoutFM2w10e7YKxD850ajhWrh6rI9
O+sjU5WObqiPJ7sZHdEw/KARzPSijH/5h8HlyYa6ClksWxYuymzCsUYYJctdjcGr
uakfXgYQ1TkkyUfNrN5G90NuRK/vTRe7bkmyGNYjN9Njac1Q18WVF59Chg==
=d5rP
- -----END PGP PUBLIC KEY BLOCK-----
-----BEGIN PGP SIGNATURE-----
Version: 2.6
iQCVAwUBL1+p4dH6sbnW3Io9AQFTKwP/cmK9gXczUsgjNmOkiOmkk8t/2p/UnAwQ
h3CzOKQiESBN5gSqh5K5Td9EILwrnRhWqymTq0p13olb56u0uTQp8nbBVReASvFC
ADXUwErN7Pu4RFEPeLJsxhqAwRk6ZzKSsI9R80aPJphws+F/aurGBu+n90lT5Dgv
D4zIbDyTdno=
=LoD9
-----END PGP SIGNATURE-----